Lxc

systemd in one container failed with "Too many open files", and Docker in another with "unable to create session key: disk quota exceeded". Neither was about files or disks: all the containers were spending the same per-user kernel quotas on the host.

A tar of a rootless Podman volume, run as the host user, skips every file owned by the container's subordinate UIDs. For Gitea that meant app.ini and the JWT key. The restore into an unprivileged LXC container then failed on chown.

The iptables ACCEPT rule for udp/67 on lxcbr0 kept counting, and dnsmasq never saw a DHCPDISCOVER. With nftables, an accept is not final: firewalld's table hooks in after it and rejected everything from the bridge.